Analysis
-
max time kernel
59s -
max time network
58s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17-06-2024 08:30
General
-
Target
Saransk.exe
-
Size
231KB
-
MD5
acca3f3236c113ab4c20d8697eeaeaca
-
SHA1
c921b69ba68786a49ed6c7ec92dac8f42700275c
-
SHA256
75f18abe6b6d94ca03e91c6eddbfaee49827e731ba78e62f4f47e890fb9dbe53
-
SHA512
787a595f745f26dcb569fe1f3beb0b90206d6bcc7e4d8a62b7e3fabf4f2435410621aec5d2b4327d357b2d3f240430974b592e23d0a247e9a082659ff6bdf39c
-
SSDEEP
6144:xloZM+rIkd8g+EtXHkv/iD4Ycpc4+ZRS63q459c2tb8e1mYoi:DoZtL+EP8Ycpc4+ZRS63q459cu/R
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Saransk.exe"C:\Users\Admin\AppData\Local\Temp\Saransk.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5cd56e155edf53e5728c46b6c9eb9c413
SHA114b1b0f090803c9ee39797aed4af13dc7849566d
SHA25670a6cf268c013fb4d907bedc12af3e5f802f179f0cc8353c7b8227dde840d31a
SHA512a4ada455d44a89fd2baa505aa9266b70913967b839522ef5da8d7afd31af6662c3ad96ac3e3531d82a72be7d019c9d88f1ce391c5b5fa0e4422a634c51491165
-
Filesize
11KB
MD53569ff1aa5310102ef02c312ca4dbe9a
SHA14124b1e805d5c487bf86182d19ed22bed6cf44ac
SHA2563ce1168408eb889f65cd4d45c12c58842a4291356c835cfb1877d017b6768a9b
SHA512c966ebf69abce51aa4fbec1e53f43485786cbeb5fb6cea18eb3407b7d4c7a212a6843b69965de9f577c483c6139840d0f7fe56d69fc8c97e6b0884b75b7aed8d
-
Filesize
256KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB